layer 3 works fine. it recognize IP source and IP connection as allowed or not